Author's note: To manage your network effectively, you need to be able to keep track of all of the important events that happen. In a small network, it is often sufficient to simply monitor the router syslog messages. But, in many networks there are too many of these messages to monitor in real time. This recipe provides one simple way of ensuring that the routers never send the unimportant messages.

Recipe 18.13: Preventing the Most Common Messages from Being Logged

Problem

You want to prevent the router from sending link up/down
syslog messages for unimportant router interfaces.

Solution

Use the no logging event configuration commands to disable the logging of common interface-level
messages:

Discussion

By default, log messages are sent whenever a router interface status changes
states. Generally, you want to see log messages that indicate that an interface
status has changed, but there are times when it can be useful to disable these
types of messages. For instance, dial interfaces may cycle up and down many
times throughout the course of a normal day without being cause for concern.
Suppressing these messages helps keep logs uncluttered and can prevent network
management staff from wasting time responding to unnecessary trouble
reports:

%LINK-3-UPDOWN: Interface Serial0, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to down%LINK-3-UPDOWN: Interface Serial0, changed state to up%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to up

This example shows the log messages that are sent when a router interface
changes states from up to down and back to up. The no logging
event link-status command will prevent the router from
creating these messages.

On Frame Relay interfaces, DLCI state changes trigger the router to create
log messages. In large Frame Relay-based networks, many DLCI changes can occur
daily, which can clutter logs and open duplicate trouble reports. The no logging event dlci-status-change configuration command will prevent these log messages from being created:

%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to INACTIVE
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to down
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to ACTIVE
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to up

You can also suppress subinterface link up or down messages by using the no logging event subif-link-status configuration command. The following example shows a typical Frame Relay
interface failure. Note that the router sends a "line protocol down" log message
for the main interface and each of the subinterfaces. Although this example only
shows one subinterface, it is not uncommon to see dozens of subinterfaces on a
single physical interface. In these cases, it can be useful to suppress
subinterface messages:

%LINK-3-UPDOWN: Interface Serial0, changed state to down
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 50 state changed to DELETED
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 102 state changed to DELETED
%FR-5-DLCICHANGE: Interface Serial0 - DLCI 103 state changed to DELETED
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0.1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Serial0, changed state to down

Kevin Dooley
is an independent networking consultant who has
been designing and implementing networks for more than ten years.